k8s: ensure zero-downtime deploys with 1 replica

- maxSurge: 1 (explicit integer, avoid percentage rounding)
- minReadySeconds: 30 (was 10) — new pod must be stable longer before old is killed
- progressDeadlineSeconds: 600 — detect stuck rollouts
- readinessProbe failureThreshold: 3 (was 2) — more tolerance after old pod is gone
- Add PodDisruptionBudget minAvailable: 1 — prevents voluntary disruptions from dropping below 1 pod

k8s/deployment.yaml

@@ -8,9 +8,10 @@ spec:
   strategy:
     type: RollingUpdate
     rollingUpdate:
-      maxSurge: 100%
+      maxSurge: 1
       maxUnavailable: 0
-  minReadySeconds: 10
+  minReadySeconds: 30
+  progressDeadlineSeconds: 600
   selector:
     matchLabels:
       app: aprs
@@ -184,4 +185,4 @@ spec:
             periodSeconds: 5
             timeoutSeconds: 2
             successThreshold: 1
-            failureThreshold: 2
+            failureThreshold: 3

k8s/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - deployment.yaml
   - service.yaml
   - service-headless.yaml
+  - pdb.yaml

k8s/pdb.yaml

@@ -0,0 +1,10 @@
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: aprs
+  namespace: aprs
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: aprs